Is CVE-2026-21852 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21852 being exploited in the wild.

How severe is CVE-2026-21852?

Medium severity, with a CVSS score of 4, published 21 January 2026.

Which products and versions are affected?

Anthropic Claude Code < 2.0.65; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.0.65.

Is there a fix for CVE-2026-21852?

Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.65 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-21852 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-21852?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21852: Anthropic Claude Code credential leakage via malicious environment configuration

Q: Is there a fix for CVE-2026-21852?

Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.65 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-21852 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-21852?

Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21852 · Severity: medium · CVSS 4 · Published 2026-01-21

Claude Code is a developer tool that enables AI-assisted coding within repositories. A vulnerability allowed malicious repository settings to trigger API calls before users confirmed whether they trusted the repository, potentially exposing their Anthropic API credentials to an attacker-controlled server. An attacker who controls a repository could steal API keys from developers who open that repository in Claude Code.

Technologies: Anthropic Claude Code, @anthropic-ai/claude-code (npm). Vendors: Anthropic, npm.

Quick answers

Is CVE-2026-21852 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21852 being exploited in the wild.
How severe is CVE-2026-21852?: Medium severity, with a CVSS score of 4, published 21 January 2026.
Which products and versions are affected?: Anthropic Claude Code < 2.0.65; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.0.65.
Is there a fix for CVE-2026-21852?: Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.65 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21852 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-21852?: Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@anthropic-ai/claude-code (npm): upgrade to 2.0.65 or later
```
npm install @anthropic-ai/claude-code@2.0.65
```

Technical details

The vulnerability stems from improper trust-confirmation ordering in Claude Code's project-load flow. When a user opens a repository containing a malicious `.env` or settings file that overrides ANTHROPIC_BASE_URL to an attacker-controlled endpoint, Claude Code would issue API requests (including the user's API key) before displaying the trust/confirmation prompt to the user. The attack requires the attacker to control a Git repository and the user to open it with Claude Code; no additional privileges or authentication are required. An attacker can exfiltrate credentials including Anthropic API keys. The vulnerability has been patched in version 2.0.65; auto-update users have already received the fix.

Affected products

Anthropic Claude Code < 2.0.65

Identifiers

CVE-2026-21852
GHSA-jh7p-qr78-84p7

Timeline

2026-01-21: disclosed
2026-01-21: patched: version 2.0.65

References

https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.